From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AE053644C7 for ; Sat, 15 Aug 2026 06:17:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774634; cv=none; b=K0k4hlHi4cyhZFC0YQ6tvlx6XTb4HVq+JmaUPyT6DJeuECsnC/MuDGOUsHWzg+Q/TyuRsLJOgSA1VEOQMyznLTPso8VyvcMc1XQxMdM2kUVXOjl/zQVk2/OltOYLdBQfvwLVE9qjaTz84F1odl6Mu1D280ilybey+Ed0JRE+hcE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774634; c=relaxed/simple; bh=mPCzvwf8uSCGjqmiXyfWXlnOnv9DnC2NARLPZKdiDBk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KZzVW+QNnoYSlrbpee1c3878gYgCrVJztOJq1hKuCxZ3RFdOwerBHjWArW4XNd6XrlUJPMTcszaVpdaqp7th/Jst5i1ahE0ChjAyCbaznXWGb8wF+N2m1SNGEWgj8AJJvYRczizPjUymVIiW/RnKtCq8DlgM0YJJrPZc8fTIzt0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YerliCR0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YerliCR0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A067E1F000E9; Sat, 15 Aug 2026 06:17:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786774633; bh=Tcy1/wkuDxqGfxnKdngia35pvlevi6ksc4SgbVSzQqo=; h=From:To:Cc:Subject:Date:Reply-To; b=YerliCR0wp4xLJ+e+WUX63EEJ7t0fIBB5/Gb2UXc55iZAabICkYch0B+PYRUEr8el KXHFMdX7u0NMsbb213MIJwQVG9o8l+02G1QloVw0L9jn1KPwQrFN9EM4LVOs+tqgQJ dY2IWFmQhtPqMts45+3am157cJkbPuL03BI3AokQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback Date: Sat, 15 Aug 2026 15:05:01 +0900 Message-ID: <2026081547-CVE-2026-72222-8ff1@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4474; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=wFYCybflYfgb9yNGVNa6NTVk6YiqVbK8AflDIIoaa4E=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDKc3bnLdPlHq7r7YIr+1+TFXL6scu1Pku3un83H57 17LPVlFOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiLgkMC04s2/klqeab7s5l neE/9F/OOCfI8J1hwbb5f+uMTxkptSUdXZe09SOTR+N+fwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(). The handshake core takes only sock_hold(req->hr_sk); nothing references the embedding struct svc_sock that svc_tcp_handshake_done() reaches via container_of(). Two close races leave the in-flight callback writing through a freed svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards its return value: a false return means handshake_complete() has already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have finished, yet svc_sock_free() proceeds to kfree(svsk). The cancel-loser fall-through inside svc_tcp_handshake() itself produces the same window: when wait_for_completion_interruptible_timeout() returns <= 0 (timeout or signal) and tls_handshake_cancel() returns false, the function does not drain, returns, and svc_handle_xprt() calls svc_xprt_received(), which clears XPT_BUSY and can drop the last reference. A concurrent close then runs svc_sock_free() while svc_tcp_handshake_done() is still updating xpt_flags and walking svsk->sk_handshake_done. The corruption surfaces as set_bit/clear_bit RMW into the freed xpt_flags slab slot and as complete_all() walking and writing the freed wait_queue_head_t list embedded in sk_handshake_done -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVC_HANDSHAKE_TO expiry. Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tls_server_hello_x509() and a successful tls_handshake_cancel() -- and at the tail of svc_tcp_handshake_done() after complete_all(). [cel: rewrote commit message to describe the actual change] The Linux kernel CVE team has assigned CVE-2026-72222 to this issue. Affected and fixed versions =========================== Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.6.145 with commit f3b55945dd99f29d83e1965d0141040a35262346 Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.12.97 with commit 2d4f97d13fff91e0bc539216be88b884b544d49f Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.18.40 with commit 3f9ee75a97a769be258784c22b89657acb5ed9bd Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.1.5 with commit 083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.2-rc1 with commit 4f988f3a2808fb659f3880c282041ff067acad78 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72222 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sunrpc/svcsock.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346 https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78